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1 . A system for detecting an observing program on a computer system, the system 
comprising: 

accessing instructions that access observer data, the observer data including 
data descriptive of an observer program, the observer program being 
programmed to observe a user's activities on the computer system and 
also operating to create data from the observing of the observer 
program; 

reading instructions that read memory of the computer system to obtain 
memory data; 

comparing instructions that compare the observer data with memory data read 

in from memory to determine whether the observer program is present 

on the computer system; 
generating instructions that generate results from the comparing, wherein the 

results generated indicate whether the observer program is present on 

the computer system; and 
outputting instructions that obtain the results and provide the results for a 

user. 

2. The system of claim 1 wherein the reading instructions read the memory of the 

computer system by querying the operating system of the computer system 
for the tasks running and by examining task information provided by the 
operating system. 
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3. The system of claim 1 wherein the outputting instructions provide the results to a 

user through a graphical user interface. 

4. The system of claim 1 wherein the reading instructions read the memory of the 

computer system by querying the file system of the computer system for the 
files located on storage media and by examining file information provided by 
the file system. 

5. The system of claim 1 wherein the reading instructions read the memory of the 

computer system by opening a file located on storage media and by 
examining contents of the file. 

6. The system of claim 1 wherein the observer data includes data descriptive of a 

plurality of observer programs and wherein the system compares the observer 
data with the memory data to determine whether any known observer 
program is present. 

7. The system of claim 1 further comprising countermeasure instructions wherein the 

countermeasure instructions alter the operation of the observer program. 
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8. The system of claim 7 wherein the countermeasure instructions alter the 

operation of the observer program by altering observer program configuration 
data. 

9. The system of claim 7 wherein the countermeasure instructions alter the 

operation of the observer program by altering a file on the computer system. 

10. The system of claim 7 wherein the countermeasure instructions alter the 

operation of the observer program by altering reporting data generated by the 
observer program. 

11. The system of claim 7 wherein the countermeasure instructions alter the 

operation of the observer program by replacing reporting data generated by 
the observer program. 

12. The system of claim 7 wherein the countermeasure instructions alter the 

operation of the observer program by replacing a file of the observer program. 

13. The system of claim 1 wherein the observer data includes data descriptive of 

observing activity typical of observing programs and wherein the system 
compares the observer data with the memory data to determine whether any 
known observer program is present. 
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14. The system of claim 1 further comprising the observer data, wherein the 

observer data includes a list of files and modules that are part of the observer 
program software, and wherein the reading instructions read the memory of 
the computer system by querying the operating system of the computer 
system for the tasks running and by examining task information provided by 
the operating system, and wherein the reading instructions also read the 
memory of the computer system by querying the file system of the computer 
system for the files located on storage media and by examining file 
information provided by the file system, and wherein the outputting 
instructions provide the results to a user through a graphical user interface. 

15. The system of claim 1 wherein the system is made available over a computer 

network through a web site. 
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16. A system for detecting an observing program on a computer system, the system 
comprising: 

means for accessing observer data, the observer data including data 
descriptive of an observer program, the observer program being 
programmed to observe a user's activities on the computer system and 
also operating to create data from the observing of the observer 
program; 

means for reading memory of the computer system to obtain memory data; 
means for comparing the observer data with memory data to determine 

whether the observer program is present on the computer system; 
means for generating results from the comparison, wherein the results 

generated indicate whether the observer program is present on the 

computer system; and 
means for outputting the results for a user. 
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17. A method for detecting an observing program on a computer system, the 
method comprising the steps of: 

accessing observer data, the observer data including data descriptive of an 

observer program, the observer program being programmed to observe 

a user's activities on the computer system and also operating to create 

data from the observing of the observer program; 
reading memory of the computer system to obtain memory data; 
comparing the observer data with memory data read in from memory to 

determine whether the observer program is present on the computer 

system; 

generating results from the reading and comparing, wherein the results 
generated indicate whether the observer program is present on the 
computer system; and 

outputting the results for a user. 
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18. A computer-readable medium containing instructions for detecting an observing 
program on a computer system, wherein the instructions comprise executable 
instructions for implementing a method comprised of the steps of: 

accessing observer data, the observer data including data descriptive of an 
observer program, the observer program being programmed to observe 
a user's activities on the computer system and also operating to create 
data from the observing of the observer program; 

reading memory of the computer system to obtain memory data; 

comparing the observer data with memory data read in from memory to 
determine whether the observer program is present on the computer 
system; 

generating results from the reading and comparing, wherein the results 
generated indicate whether the observer program is present on the 
computer system; and 

outputting the results for a user. 

19. The computer-readable medium of claim 18 wherein the computer-readable 
medium is a data transmission medium. 
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20. A system for altering the operation of an observer program on a computer 
system, the system comprising: 

accessing instructions that access observer information, the observer 

information including data descriptive of the observer program, the 
observer program being programmed to observe a user's activities on 
the computer system and also operating to create data from the 
observing of the observer program; 

reading instructions that read memory of the computer system to obtain files 
relating to the observer program; 

altering instructions that alter a file relating to the observer program such that 
the operation of the observer program is changed. 

21 . The system of claim 20 further comprising an observer detection program. 

22. The system of claim 20 further comprising inputting instructions that display to a 

user options regarding the altering and that take input from the user relating to 
the options. 

23. The system of claim 20 wherein the altering instructions alter the operation of 

the observer program by altering observer program configuration data. 

24. The system of claim 20 wherein the altering instructions alter the operation of 

the observer program by altering a file on the computer system. 

316895.1 

-40- 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 



25. The system of claim 20 wherein the altering instructions alter the operation of 
the observer program by altering reporting data generated by the observer 
program. 



26. The system of claim 20 wherein the altering instructions alter the operation of 
the observer program by replacing reporting data generated by the observer 
program. 



27. The system of claim 20 wherein the altering instructions alter the operation of 
the observer program by replacing a file of the observer program. 



28. The system of claim 20 wherein the system is made available over a computer 
network through a web site. 
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29. A system for altering the operation of an observer program on a computer 

system, the system comprising: 

means for accessing observer information, the observer information including 
data descriptive of the observer program, the observer program being 
programmed to observe a user's activities on the computer system and 
also operating to create data from the observing of the observer 
program; 

means for reading memory of the computer system to obtain files relating to 

the observer program; and 
means for altering a file relating to the observer program such that the 

operation of the observer program is changed. 
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30. A method for altering the operation of an observer program on a computer 

system, the method comprising the steps of: 

accessing observer information, the observer information including data 
descriptive of the observer program, the observer program being 
programmed to observe a user's activities on the computer system and 
also operating to create data from the observing of the observer 
program; 

reading memory of the computer system to obtain files relating to the observer 
program; and 

altering a file relating to the observer program such that the operation of the 
observer program is changed. 
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31. A computer-readable medium containing instructions for altering the operation of 
an observer program on a computer system, wherein the instructions comprise 
executable instructions for implementing a method comprised of the steps of: 

accessing observer information, the observer information including data 
descriptive of the observer program, the observer program being 
programmed to observe a user's activities on the computer system and 
also operating to create data from the observing of the observer 
program; 

reading memory of the computer system to obtain files relating to the observer 
program; and 

altering a file relating to the observer program such that the operation of the 
observer program is changed. 

32. The computer-readable medium of claim 31 wherein the computer-readable 
medium is a data transmission medium. 
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